"""Bearer-token auth for the mobile app (Flask sessions are unreliable on native clients)."""
from flask import current_app, request, session
from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer

TOKEN_SALT = "anicove-mobile-auth"
TOKEN_MAX_AGE = 30 * 24 * 60 * 60


def _serializer():
    return URLSafeTimedSerializer(current_app.config["SECRET_KEY"], salt=TOKEN_SALT)


def issue_mobile_token(user_id, username, avatar=None):
    return _serializer().dumps({
        "user_id": str(user_id),
        "username": username,
        "avatar": avatar,
    })


def parse_mobile_token(token):
    try:
        return _serializer().loads(token, max_age=TOKEN_MAX_AGE)
    except (BadSignature, SignatureExpired, TypeError, ValueError):
        return None


def require_mobile_auth():
    """Return (user_id, username, avatar) from session or Bearer token."""
    if session.get("username") and session.get("_id") is not None:
        return str(session["_id"]), session["username"], session.get("avatar")

    header = request.headers.get("Authorization") or ""
    token = ""
    if header.lower().startswith("bearer "):
        token = header.split(" ", 1)[1].strip()
    if not token:
        token = (request.headers.get("X-Auth-Token") or "").strip()
    if not token:
        data = request.get_json(silent=True) or {}
        token = str(data.get("token") or request.args.get("token") or "").strip()
    if not token:
        return None

    payload = parse_mobile_token(token)
    if not payload or not payload.get("user_id") or not payload.get("username"):
        return None
    return str(payload["user_id"]), payload["username"], payload.get("avatar")